Skip to content

[Snyk] Fix for 23 vulnerabilities#59

Open
philsawicki wants to merge 1 commit into
masterfrom
snyk-fix-d9b7052c476ff3fcb3598d3594367681
Open

[Snyk] Fix for 23 vulnerabilities#59
philsawicki wants to merge 1 commit into
masterfrom
snyk-fix-d9b7052c476ff3fcb3598d3594367681

Conversation

@philsawicki
Copy link
Copy Markdown
Owner

@philsawicki philsawicki commented Nov 30, 2023

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		 Yes Proof of Concept
high severity 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5		 Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 Yes Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Command Injection
SNYK-JS-LODASH-1040724		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-450202		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-608086		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-73638		 Yes Proof of Concept
medium severity 541/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-73639		 Yes Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Command Injection
SNYK-JS-LODASHTEMPLATE-1088054		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-1019388		 Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		 Yes No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 No Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-SOCKETIOPARSER-1056752		 Yes Proof of Concept
critical severity 704/1000
Why? Has a fix available, CVSS 9.8		 Improper Input Validation
SNYK-JS-SOCKETIOPARSER-3091012		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-USERAGENT-174737		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-WS-1296835		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Prototype Pollution
SNYK-JS-XML2JS-5414874		 Yes Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:braces:20180219		 Yes Proof of Concept
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:lodash:20180130		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:parsejson:20170908		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: coveralls The new version differs by 3 commits.
  • 2ed4d09 major version bump for node > 4.x
  • 5ebe57f bump version
  • 428780c Expand allowed dependency versions to all API compatible versions (#172)

See the full diff

Package name: gulp The new version differs by 134 commits.
  • 55eb23a Release: 4.0.0
  • 173a532 Docs: Fix the installation instructions
  • ec54d09 Docs: Improve note about out-of-date docs
  • 03b7c98 Docs: Update recipes to install gulp@next
  • 2eba29e Docs: Remove run-sequence from recipes
  • 76eb4d6 Docs: Add installation instructions & update badges
  • fbc162f Docs: Remove references to gulp-util
  • 3011cf9 Scaffold: Normalize repository
  • f27be05 Update: Remove graceful-fs from test suite
  • 361ab63 Upgrade: Update glob-watcher
  • 064d100 Build: Avoid broken node 9
  • 057df59 Release: 4.0.0-alpha.3
  • c1ba80c Breaking: Upgrade major versions of glob-watcher, gulp-cli & vinyl-fs
  • 89acc5c Docs: Improve ES2015 task exporting examples (#1999)
  • 0ac9e04 Docs: Add "Project structure" section to CONTRIBUTING.md (#1859)
  • 723cbc4 Docs: Fix syntax in recipe example (#1715)
  • d420a6a Docs: Have gulp.lastRun take a function to avoid task registration (#1828)
  • 29ece6f Upgrade: Update undertaker
  • e931cb0 Docs: Fix changelog typos (#1696)
  • 477db84 Docs: Add a "BrowserSync with Gulp 4" recipe (#1659)
  • d4ed3c7 Docs: Add options.cwd for gulp.src API (#1645)
  • 5dc3b07 Docs: Update gulp.watch API to align with glob-watcher
  • 0c66069 Breaking: Replace chokidar as gulp.watch with glob-watcher wrapper
  • c3dbc10 Docs: Clarify incremental builds example (#1609)

See the full diff

Package name: gulp-eslint The new version differs by 95 commits.
  • 1d79ed0 4.0.1
  • 8f7e966 replace all HTTP protocols with HTTPS
  • b48a04a remove deprecated gulp-util dependency (#213)
  • 35eae57 update devDependencies (#207)
  • 47bd269 use npx to simplify after_script
  • 29dbab5 inherit autofix-related props even if `quiet` option is enabled
  • a398838 4.0.0
  • 18a4299 emit an error when it fails to load an ESLint plugin
  • b8bf261 update ESLint from v3 to v4 (#198)
  • c0e82ce use `Buffer.from` instead of `new Buffer`
  • e6c67a2 drop support for linting `Stream` contents
  • 132d5cc Fix formatting issues in README.md (#194)
  • 7f65378 remove link to config file `globals` doc
  • 8ddfb84 correct the type of `globals` option in README
  • 6059c22 3.0.1
  • b0c2816 ensure sharable config works
  • 08b9212 test the case where babel-eslint is actually useful
  • eb98701 mock stream-mode vinyl files with from2-string
  • bcd7736 fix invalid `envs` option
  • 286b0c4 remove unused fixtures
  • e2723e1 Remove unnecessary `object-assign` dependency
  • 82c1949 3.0.0
  • 97d8638 Remove invalid options in example code
  • 505779d Remove option aliases

See the full diff

Package name: gulp-uglify The new version differs by 9 commits.
  • e4f9045 2.0.0
  • 566ec6a refactor(tests): write tests with mocha
  • 5651111 refactor(tests): replace `cmem` with `testdouble`
  • b82387b refactor(tests): compose streams with `mississippi` utilities
  • 1232c3c fix(errors): emit errors of type `GulpUglifyError`
  • 5632cee fix(minifer): use `gulplog` for the warning
  • 8160697 feat(minifier): use UglifyJS 2.7.0's input map support
  • 3ec8fc3 chore(package): update uglify-js to version 2.7.0
  • a9c55b9 doc(README): spelling mistake in example

See the full diff

Package name: http-server The new version differs by 141 commits.
  • 46cfd10 0.12.2
  • 5867a26 add testing on node 14
  • a8f1a15 Merge pull request #581 from xxjinwei/master
  • 0568097 Merge pull request #517 from http-party/man_page
  • 021e9f5 update license year
  • 6e9fc08 update dependencies
  • 95119c6 update man page
  • 943c609 Merge pull request #622 from adunkman/fix-security-vulnerability
  • 817e11d Upgrade sub-dependency of minimist via mkdirp.
  • 454851c Fix security issue by using Minimist directly.
  • ed8ff1f clarify auth types
  • f5854a6 Merge pull request #584 from zjhmale/basic-auth-options-compliance
  • e758f03 Merge pull request #586 from http-party/logFn-skip-array
  • 924567f Merge pull request #599 from http-party/new-screenshots
  • 8de3658 Merge pull request #613 from http-party/dependabot/npm_and_yarn/acorn-5.7.4
  • b2dbff5 Bump acorn from 5.7.3 to 5.7.4
  • 85541e5 ignore macos files
  • dfcc224 better start image
  • bd36f7b Fix basic auth options type issue
  • 7c09c23 remove broken badge
  • e5673c5 update badges
  • 1572613 Update installation methods
  • 61668b3 update README image link
  • 91ff74b update start image

See the full diff

Package name: karma The new version differs by 250 commits.
  • 1b48637 chore(release): 5.0.0 [skip ci]
  • a5dbe89 Update issue templates (#3460)
  • 1074f38 chore(ci): rely on karma-runnre/integration-tests for saucelabs config (#3462)
  • 4d45cf0 chore(ci): remove more old connection security stuffs (#3459)
  • be76fcc chore(ci): use travis UI for sauce config (#3458)
  • a04a542 chore(ci): remove secure encryption var (#3457)
  • 1eaf35e fix: install semantic-release as a regular dev dependency (#3455)
  • 0647109 docs: Fix simple typo, overriden -> overridden (#3453)
  • ec1e69a fix(server): replace optimist on yargs lib (#3451)
  • ffad7fa refactor(launcher): use class syntax (#3437)
  • 7166ce2 fix(server): detection new MS Edge Chromium (#3440)
  • b8b2ed8 fix(ci): echo travis env that gates release after_success (#3446)
  • 33a069f refactor: use native Promise instead of Bluebird (#3436)
  • 131d154 refactor: drop safe-buffer dependency in favor of native Buffer (#3438)
  • cb1bcbf fix(server): cleanup import of the removed method (#3439)
  • 5c334f5 fix(server): createPreprocessor was removed (#3435)
  • d7128d4 refactor(server): remove PromiseContainer class (#3416)
  • 057d527 feat(docs): document `DEFAULT_LISTEN_ADDR` constant (#3443)
  • a673aa8 ci: drop node 8, adopt node 12 (#3430)
  • 9eb6436 chore(server): Convert PromiseContainer to object and remove (#3401)
  • 0856234 chore(travis): release on node 10 success (#3428)
  • 708ae13 feat(preprocessor): obey Pattern.isBinary when set (#3422)
  • 00d536f chore(test): logLevel debug in proxy test (#3427)
  • da9d8bd chore(docs): delete PULL_REQUEST_TEMPLATE.md

See the full diff

Package name: karma-coverage The new version differs by 48 commits.
  • 32acafa chore(release): 2.0.2 [skip ci]
  • bb8f9ee chore: add semantic-release for project - fix #408 (#413)
  • 9c37de6 chore: add check commit message (#411)
  • 27822c9 ci(test): use eslint as ci command and add all js files to check by eslint (#410)
  • 1adb27a ci: drop node 8, adopt node 12 (#409)
  • 4962a70 fix(reporter): update calls to match new API in istanbul-lib-report fix #398 (#403)
  • fc6e289 refactor: remove isAbsolute and replace with path.isAbsolute (#405)
  • 83bafc3 refactor: replace migrate coffee unit tests to modern JS (#407)
  • 49f174d refactor: onRunComplete method to upgrade on new major version of Istanbul (#406)
  • 4cfa697 chore: Update dev Dependencies eslint and load-grunt-tasks (#387)
  • 5cf931a fix: remove information about old istanbul lib (#404)
  • 352254a chore(deps): bump handlebars from 4.1.2 to 4.5.3 (#399)
  • 0ee780c chore(deps): bump lodash.template from 4.4.0 to 4.5.0 (#392)
  • d18cde4 chore(deps-dev): bump eslint from 2.13.1 to 4.18.2 (#397)
  • 55aeead Update Source Map Handling (#394)
  • b23664e Added debug msg whether coverage is in reporters (#396)
  • d3f53e3 chore(all): Migrate to ES6 (#385)
  • 9c8a222 Make travis file simpler (#386)
  • b76db9e Remove unused dateformat dependency (#384)
  • 075ece0 Remove unused istanbul dependency (#382)
  • 9184fc0 chore: release v2.0.1
  • 57d4bd3 chore(deps): npm audit fix --force; update travis.yml (#380)
  • 0e2800b chore: release v2.0.0
  • 99c0c35 chore: update contributors

See the full diff

Package name: protractor The new version differs by 128 commits.
  • 5d8da04 chore(release): version bump to 6.0.0 and update the changelog
  • d777738 chore(tests): circleci - chrome 69 requires chromdriver to 2.44 (#5182)
  • 3d50b68 chore(deps): update based on npm audit
  • e478ba8 chore(release): bump version to 6.0.1-beta
  • 7054827 chore(types): fix types to use not @ types/selenium-webdriver (#5127)
  • 2e5c2e6 chore(jasmine): prevent random execution order in jasmine 3 (#5126)
  • 8afc4e2 chore(release): release 6.0.0-beta and update the changelog
  • 5fd711c chore(webdriver-manager): use webdriver-manager@13.0.0-beta
  • 96ae17c deps(jasmine): upgrade jasmine 3.3 (#5102)
  • 68491dd chore(expectedConditions): update generic Function typings (#5101)
  • cf43651 chore(debugprint): convert debugprint to TypeScript (#5074)
  • d213aa9 deps(selenium): upgrade to selenium 4 (#5095)
  • 4672265 chore(browser): remove timing issues with restart and fork (#5085)
  • b4dbcc2 chore(elementexplorer): remove explorer bin file (#5094)
  • 7de6d85 docs(api): update examples to use async/await (#5081)
  • 1b2036e typings(selenium): try out new version of typings (#5084)
  • befb457 chore(bin): update webdriver-manager require to use the cli (#5093)
  • 509f1b2 deps(latest): upgrade to the gulp and typescript (#5089)
  • 2def202 deps(webdriver-manager): use replacement (#5088)
  • 9d510db chore(test): remove jasmine addMatcher test (#5072)
  • 6522e40 chore(cleanup): clean up imports and wdpromises (#5073)
  • 3b8f263 chore(ignoreSynchornization): clean up to use waitForAngularEnabled (#5071)
  • ffa3519 chore(debugger): remove debugger and explore methods (#5070)
  • 0f7a38a chore(test): error tests fixed (#5069)

See the full diff

Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Improper Input Validation

@snyk-bot
fix: package.json & package-lock.json to reduce vulnerabilities
6ce69e1 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-LODASH-73638
- https://snyk.io/vuln/SNYK-JS-LODASH-73639
- https://snyk.io/vuln/SNYK-JS-LODASHTEMPLATE-1088054
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-1019388
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-1056752
- https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-3091012
- https://snyk.io/vuln/SNYK-JS-USERAGENT-174737
- https://snyk.io/vuln/SNYK-JS-WS-1296835
- https://snyk.io/vuln/SNYK-JS-XML2JS-5414874
- https://snyk.io/vuln/npm:braces:20180219
- https://snyk.io/vuln/npm:lodash:20180130
- https://snyk.io/vuln/npm:parsejson:20170908
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@philsawicki @snyk-bot